# CVE-2026-118661: Happy DOM cookie scope forgery in CookieContainer

Source: https://junglewise.ai/threats/cve-2026-118661-happy-dom-is-a-javascript-implementation-of-a-web-browser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118661 · Severity: medium · CVSS 6.5 · Published 2026-10-28

Happy DOM is a headless browser implementation used in server-side rendering and prerendering applications. The CookieContainer fails to properly validate cookie Domain attributes, allowing an attacker to forge cookies for unrelated domains. In applications that contact attacker-controlled servers before making requests to victim services, this enables session fixation or cookie injection attacks.

Technologies: [Capricorn86 Happy DOM](https://junglewise.ai/threats/technologies/capricorn86-happy-dom), [happy-dom (npm)](https://junglewise.ai/threats/technologies/happy-dom). Vendors: [Capricorn86](https://junglewise.ai/threats/vendors/capricorn86), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118661 being exploited in the wild.

**How severe is CVE-2026-118661?** Medium severity, with a CVSS score of 6.5, published 28 October 2026.

**Which products and versions are affected?** Capricorn86 Happy DOM before 20.14.6; happy-dom (npm) <= 20.14.5, SEMVER:introduced=0,fixed=20.14.6.

**Is there a fix for CVE-2026-118661?** Yes. happy-dom (npm): upgrade to 20.14.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118661 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118661?** Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- happy-dom (npm): upgrade to 20.14.6 or later

  ```sh
  npm install happy-dom@20.14.6
  ```


## Technical details

The CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes: it accepts domains unrelated to the origin setting the cookie (including public suffixes), and the cookieMatchesURL function fails to enforce DNS-label boundaries when matching suffixes. An attacker can plant forged cookies in a server-side rendering context and have them delivered to a victim origin, exploiting inadequate cookie scope validation.

## Affected products

- capricorn86 Happy DOM before 20.14.6

## Identifiers

- CVE-2026-118661
- GHSA-5fpq-26gf-qwcr

## Timeline

- 2026-10-28: disclosed
- 2026-10-08: patched

## References

- [https://github.com/capricorn86/happy-dom/commit/f21dbd7d0a0c63cdd41954ba5d0f05def4e0f2b3](https://github.com/capricorn86/happy-dom/commit/f21dbd7d0a0c63cdd41954ba5d0f05def4e0f2b3)
- [https://github.com/capricorn86/happy-dom/pull/2477](https://github.com/capricorn86/happy-dom/pull/2477)

## Related threats

- [Happy DOM server-side request forgery via iframe and CSS loading](https://junglewise.ai/threats/cve-2026-118660-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM code injection in ESM compiler](https://junglewise.ai/threats/cve-2026-115895-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [capricorn86 Happy DOM cookie leakage in fetch requests](https://junglewise.ai/threats/cve-2026-34226-capricorn86-happy-dom-cookie-leakage-in-fetch-requests)
- [capricorn86 Happy DOM code injection in ECMAScriptModuleCompiler](https://junglewise.ai/threats/cve-2026-33943-capricorn86-happy-dom-code-injection-in-ecmascriptmodulecompiler)
- [happy-dom prototype pollution allowing arbitrary code execution](https://junglewise.ai/threats/cve-2025-62410-happy-dom-prototype-pollution-allowing-arbitrary-code-execution)